Data processing addendum.

1. Definitions and interpretation

1.1 "Agreement" means the agreement under which Marathon provides durin to Customer, including any order form or enterprise agreement and, where no signed agreement exists, the public Terms at https://getdurin.com/terms.

1.2 "Applicable Data Protection Law" means the data protection laws that apply to the processing of Customer Personal Data under the Agreement, including, where applicable, the Singapore Personal Data Protection Act 2012 and its regulations (the "PDPA"), Regulation (EU) 2016/679 (the "EU GDPR"), and the EU GDPR as it forms part of the law of the United Kingdom (the "UK GDPR"), together with the Data Protection Act 2018. [Coverage of other data protection laws, such as the Swiss Federal Act on Data Protection, to be confirmed by counsel before publish]

1.3 "Customer Personal Data" means personal data that Marathon processes on behalf of Customer to provide durin under the Agreement, as described in Annex 1. It excludes personal data that Marathon processes for its own purposes as a controller or organisation, as described in the privacy notice at https://getdurin.com/privacy.

1.4 "Restricted Transfer" means a transfer of Customer Personal Data that is subject to section 26 of the PDPA, Chapter V of the EU GDPR, or Chapter V of the UK GDPR.

1.5 "Security Incident" means a personal data breach under the EU GDPR or UK GDPR, or a data breach under the PDPA, affecting Customer Personal Data in the possession or under the control of Marathon or its Subprocessors.

1.6 "Subprocessor" means a third party that Marathon engages to process Customer Personal Data on its behalf in providing durin. The customer-selected services described in clause 7.6 are not Subprocessors.

1.7 "EU SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021. "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018, version B1.0, as amended or replaced.

1.8 "Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the EU GDPR or UK GDPR, and "organisation", "data intermediary", "personal data" and "data breach" have the meanings given in the PDPA, in each case as they apply to the relevant processing. "Including" means including without limitation.

2. Scope and roles

2.1 This DPA forms part of the Agreement and applies to the processing of Customer Personal Data. It takes effect when both parties have signed it and continues for as long as Marathon processes Customer Personal Data, including after the Agreement ends until clause 11 is complete.

2.2 Customer is the controller under the EU GDPR or UK GDPR, and the organisation under the PDPA, for Customer Personal Data, or processes it on behalf of another controller. Marathon is Customer’s processor and, under the PDPA, its data intermediary. Where Customer acts as a processor, Customer confirms that its instructions and its appointment of Marathon are authorised by the relevant controller.

2.3 Annex 1 describes the subject matter, nature, purpose and duration of the processing, the types of Customer Personal Data and the categories of data subjects.

2.4 Marathon processes personal data for its own purposes, such as account administration, billing, support, security, fraud prevention, product analytics and legal compliance, as a controller or organisation under its privacy notice. That processing is outside this DPA. [Scope of Marathon’s independent processing of service data to be confirmed by counsel before publish]

3. Instructions

3.1 Marathon processes Customer Personal Data only on Customer’s documented instructions, including with regard to Restricted Transfers, unless applicable law requires otherwise. In that case, Marathon will inform Customer of the legal requirement before processing unless that law prohibits it on important grounds of public interest.

3.2 Customer’s documented instructions are this DPA and the Agreement; Customer’s configuration and use of durin, including its members, roles, agent clients, connections, policies, approval settings, conversation capture mode and retention period, notification channels and export destinations; and any further written instructions the parties agree.

3.3 Marathon will immediately inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. This does not oblige Marathon to provide legal advice to Customer.

4. Customer responsibilities

4.1 Customer is responsible for the lawfulness of its instructions and of the Customer Personal Data it causes durin to process, including giving any required notices, obtaining any required consents, and having a lawful basis or applicable exception for that processing.

4.2 Customer decides which systems, agent clients and model providers its users connect to durin. durin’s controls apply to requests routed through durin. An agent client can send returned tool results to its model provider, whose terms apply separately.

4.3 durin is not designed to apply additional safeguards to special categories of personal data or other sensitive personal data. Customer decides whether to route such data through durin and configures its connections, policies and conversation capture accordingly. [Any restriction on special category or other sensitive data to be confirmed by counsel before publish]

4.4 Customer is responsible for securing its accounts, credentials, agent clients, devices and connected systems, and for configuring durin’s controls, such as policies, approval requirements and identity provider settings, to suit its risk.

5. Confidentiality

5.1 Marathon ensures that persons it authorises to process Customer Personal Data are bound by an appropriate obligation of confidentiality and access Customer Personal Data only as needed to provide, support or secure durin or to comply with law.

6. Security

6.1 Marathon implements the technical and organisational measures in Annex 2, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to individuals. Marathon makes reasonable security arrangements to protect Customer Personal Data in its possession or under its control, as the PDPA requires of a data intermediary.

6.2 Marathon may update the measures in Annex 2 as durin and the threats to it change, provided that an update does not materially reduce the overall protection of Customer Personal Data.

6.3 Annex 2 describes implemented controls and management commitments. Marathon does not hold SOC 2 attestation, ISO/IEC 27001 certification or an independent penetration-test result, and does not represent the measures in Annex 2 as certified or independently assured.

7. Subprocessors

7.1 Customer gives Marathon general written authorisation to engage Subprocessors. Annex 3 lists the Subprocessors on the date of this DPA. The current subprocessor schedule is published at https://getdurin.com/subprocessors.

7.2 Marathon will notify Customer of any intended addition or replacement of a Subprocessor at least [subprocessor notice period to be confirmed by counsel before publish] before the new Subprocessor processes Customer Personal Data, by email to the privacy contact in the signature block and by updating the subprocessor schedule.

7.3 Customer may object to the change on reasonable data protection grounds by emailing privacy@getdurin.com within the notice period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Agreement by written notice before the change takes effect. [Remedies for an unresolved objection, including any refund of prepaid fees, to be confirmed by counsel before publish]

7.4 Marathon engages each Subprocessor under a written contract that imposes data protection obligations no less protective than this DPA, to the extent applicable to the services the Subprocessor provides. Marathon remains responsible to Customer for the performance of its Subprocessors’ obligations as Applicable Data Protection Law requires.

7.5 On request, Marathon will provide information about the data protection terms that apply to a Subprocessor. Marathon may redact confidential commercial information.

7.6 Services that Customer selects or connects are not Subprocessors. They include the systems Customer connects to durin, Customer’s Slack workspace and other notification channels, export destinations such as Langfuse, a Vanta account Customer connects for governance evidence, TypeSafe AI used with Customer’s own API key, and agent clients and their model providers. Marathon transmits Customer Personal Data to them on Customer’s instructions, and their own terms govern their processing.

8. International transfers

8.1 Marathon is established in Singapore. Marathon and its Subprocessors may process Customer Personal Data in Singapore and in the countries and territories listed for each Subprocessor in Annex 3. Marathon does not commit to processing Customer Personal Data in a particular region unless the Agreement expressly includes a residency commitment.

8.2 Where Marathon or a Subprocessor transfers Customer Personal Data that is subject to the PDPA to a country or territory outside Singapore, Marathon will ensure that the recipient is bound by legally enforceable obligations, as required by the Personal Data Protection Regulations 2021, to provide the transferred personal data a standard of protection at least comparable to the protection under the PDPA. Where those obligations are contractual, the contract specifies the countries and territories to which the personal data may be transferred. Marathon will give Customer the information it reasonably needs to meet its own obligations under section 26 of the PDPA. [Contractual instrument for PDPA transfers, such as the ASEAN Model Contractual Clauses, to be confirmed by counsel before publish]

8.3 Where Customer’s transfer of Customer Personal Data to Marathon is a Restricted Transfer under Chapter V of the EU GDPR that is not covered by an adequacy decision or another transfer mechanism, the EU SCCs are incorporated into this DPA as follows: Module Two applies where Customer is a controller and Module Three applies where Customer is a processor, with Customer as data exporter and Marathon as data importer; for Clause 9, Option 2 applies with the notice period in clause 7.2; the optional wording in Clause 11 does not apply; Annexes I and II of the EU SCCs are completed with Annex 1 and Annex 2 of this DPA; and the Subprocessors authorised under Clause 9 are those listed in Annex 3, as updated under clause 7. [Selections for Clauses 7, 13, 17 and 18 of the EU SCCs, and the mechanism for transfers to an importer whose processing is subject to the EU GDPR under Article 3(2), to be confirmed by counsel before publish]

8.4 Where the transfer is a Restricted Transfer under Chapter V of the UK GDPR that is not covered by regulations approving the transfer under Article 45A of the UK GDPR or another transfer mechanism, the EU SCCs apply as amended by the UK Addendum, and Tables 1 to 3 of the UK Addendum are completed with the information in this DPA and its Annexes. The EU SCCs are not relied on for those transfers without the UK Addendum. [Table 4 selection, and any use of the UK International Data Transfer Agreement instead of the UK Addendum, to be confirmed by counsel before publish]

8.5 Before a Subprocessor processes Customer Personal Data in a way that is a Restricted Transfer, Marathon will put in place a transfer mechanism recognised under the applicable law, such as Module Three of the EU SCCs with the UK Addendum where required, an adequacy decision or other recognised framework, or, for the PDPA, legally enforceable obligations, together with any supplementary measures the law requires. Annex 3 identifies the mechanism used for each Subprocessor.

8.6 Unless the law prohibits it, Marathon will notify Customer if it receives a legally binding request from a public authority for disclosure of Customer Personal Data, will assess the lawfulness of the request, and will disclose only the minimum Customer Personal Data the request requires. Marathon will give Customer reasonable information to support its assessment of the laws and practices that apply to a Restricted Transfer.

8.7 If this DPA or the Agreement conflicts with the EU SCCs or the UK Addendum, the EU SCCs or the UK Addendum prevail to the extent of the conflict.

9. Security incidents

9.1 Where Marathon acts as Customer’s processor under the EU GDPR or UK GDPR, Marathon will notify Customer without undue delay after becoming aware of a Security Incident. Where Marathon acts as Customer’s data intermediary under the PDPA, Marathon will notify Customer without undue delay once it has reason to believe that a data breach affecting Customer Personal Data has occurred.

9.2 Any contractual notice target of [customer notice period to be confirmed by counsel before publish] does not postpone either obligation in clause 9.1. [Alignment with the privacy notice, the definition of becoming aware, and the content of notice to be confirmed by counsel before publish]

9.3 The notice will describe, to the extent then known, the nature of the Security Incident, including the categories and approximate number of data subjects and records concerned; its likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact for further information. Marathon may provide this information in phases as it becomes available.

9.4 Marathon will take reasonable steps to contain, investigate and remediate the Security Incident and will give Customer reasonable assistance to meet its obligations to notify supervisory authorities, the Personal Data Protection Commission and affected individuals. Customer decides whether to make those notifications. Marathon will not notify Customer’s supervisory authority or the affected individuals about a Security Incident without Customer’s approval unless the law requires it.

9.5 Unsuccessful attempts and activities that do not compromise the security of Customer Personal Data, such as pings, port scans, denied requests and failed sign-in attempts, are not Security Incidents. Notifying a Security Incident is not an acknowledgement of fault or liability.

10. Assistance

10.1 If Marathon receives a request from a data subject about Customer Personal Data and can identify that it relates to Customer, Marathon will forward it to Customer without undue delay. Marathon will not respond to the request, other than to refer the data subject to Customer, unless the law requires otherwise.

10.2 Taking into account the nature of the processing, Marathon will assist Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests to exercise data subject rights under Applicable Data Protection Law, including requests for access and correction under the PDPA. durin’s administration features, such as removing members and exporting audit records, support those responses.

10.3 Taking into account the nature of the processing and the information available to it, Marathon will give Customer reasonable assistance with data protection impact assessments, prior consultations with supervisory authorities, and Customer’s security and breach-notification obligations. [Allocation of costs for assistance beyond durin’s self-service features to be confirmed by counsel before publish]

11. Deletion and return

11.1 During the term of the Agreement, Customer sets the retention period for optional conversation capture: 7, 90, or 180 days, or 360 days on Enterprise. Expired captures become unreadable and scheduled cleanup removes them. Other Customer Personal Data is retained as described in Annex 1 and as needed to provide durin in line with Customer’s instructions.

11.2 When the Agreement ends, Marathon will delete Customer Personal Data within [deletion and return period to be confirmed by counsel before publish] or, if Customer elects in writing before then, return it and then delete the remaining copies, unless applicable law requires Marathon to keep it. Before the Agreement ends, Customer can export audit records with durin’s export features.

11.3 Customer Personal Data in backups is deleted as those backups expire within [backup expiry period to be confirmed by counsel before publish]. Until then, Marathon keeps it protected under this DPA and does not actively process it.

11.4 Customer Personal Data that Marathon must keep by law remains protected under this DPA and is processed only for the purpose that law requires. On Customer’s written request, Marathon will confirm in writing the deletion it has carried out under this clause.

12. Information and audits

12.1 Marathon will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA and with Article 28 of the EU GDPR and UK GDPR, including the durin security review at https://getdurin.com/trust/review.md and written responses to Customer’s reasonable security and privacy questionnaires.

12.2 Marathon does not hold third-party certifications or attestations that could replace an audit. Where the information under clause 12.1 does not reasonably demonstrate compliance, or a supervisory authority requires it, Customer or an independent auditor bound by confidentiality who is not a competitor of Marathon may audit Marathon’s compliance with this DPA on reasonable prior written notice. An audit takes place during business hours, is limited to the processing of Customer Personal Data, and must not require access to other customers’ data or compromise the security of durin. [Audit notice period, frequency, format and cost allocation to be confirmed by counsel before publish]

12.3 Audits under Clause 8.9 of the EU SCCs are carried out in accordance with this clause, to the extent consistent with the EU SCCs.

13. Liability

13.1 Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent that Applicable Data Protection Law, the EU SCCs or the UK Addendum do not permit such a limitation, including for liability to data subjects. [Liability cap and any carve-outs for data protection claims to be confirmed by counsel before publish]

14. General terms

14.1 For the processing of Customer Personal Data, the following order of precedence applies: the EU SCCs and the UK Addendum, where they apply; then this DPA; then the rest of the Agreement. [Full order of precedence among Order Form, DPA, Terms and policies to be confirmed by counsel before publish]

14.2 This DPA is governed by the laws of the Republic of Singapore, and the courts of Singapore have exclusive jurisdiction over disputes arising out of or in connection with it, except where the EU SCCs or the UK Addendum require a different governing law or forum for disputes under them.

14.3 If Applicable Data Protection Law changes, or a transfer mechanism in clause 8 is amended, replaced or invalidated, the parties will negotiate in good faith any change to this DPA needed to keep the processing lawful.

14.4 If any provision of this DPA is invalid or unenforceable, the rest of this DPA remains in effect.

14.5 Notices to Marathon under this DPA are sent to privacy@getdurin.com. General and commercial correspondence is sent to contact@getdurin.com. Notices to Customer are sent to the privacy contact in the signature block.

Annex 1: Description of processing

This Annex describes the processing of Customer Personal Data and completes Annex I of the EU SCCs where they apply.

Data exporter

Customer, as identified in the signature block. Role: controller, or processor on behalf of its own controller. Contact: the privacy contact in the signature block. Activities: using durin to govern agent access to the systems Customer connects.

Data importer

Marathon Digital Pte Ltd., a Singapore company (UEN 202023814G), operator of durin. Role: processor and, under the PDPA, data intermediary. Contact: privacy@getdurin.com. Address: [registered address to be confirmed by counsel before publish]. Activities: providing durin to Customer under the Agreement.

Categories of data subjects

Customer’s members, administrators and approvers; people whose personal data appears in content that Customer’s users or agents route through durin, such as Customer’s employees, customers and contacts; and people identified in connection, upstream account or device metadata.

Categories of personal data

Membership and directory data, such as names, email addresses, roles and team memberships; governance and audit metadata, such as requester, agent client, connection, tool, resource, policy decision, approval, timestamps and execution outcome; personal data in tool requests and results routed through durin; connection configuration associated with Customer’s upstream accounts; redacted conversation content, if an administrator enables capture; approval decisions remembered with one-way request sketches, while approval memory is on; policy descriptions an administrator submits for AI policy drafting, if it is turned on; approval details delivered to the notification channels Customer selects; and device and agent configuration metadata reported through Shadow MCP discovery, if Customer enables it.

Sensitive data

None is intended. If Customer routes special categories of personal data or other sensitive personal data through durin, clause 4.3 applies and the measures in Annex 2 protect it.

Frequency

Continuous, while Customer’s users and agents use durin.

Nature of the processing

Authenticating users and agent clients; evaluating requests against Customer’s policies and approvals; sending allowed requests to the systems Customer connects and returning their results; recording governance metadata; remembering approval decisions so they can inform or decide matching requests; optional AI-assisted drafting of policy rules; storing configuration and encrypted credentials; optional conversation capture with pattern-based redaction; delivering approval notifications; exporting records on request; and deleting data.

Purpose

To provide, support and secure durin for Customer under the Agreement.

Duration and retention

For the term of the Agreement and until deletion or return under clause 11. Optional conversation capture is kept for the period Customer configures: 7, 90, or 180 days, or 360 days on Enterprise. [Retention periods for governance metadata and other categories to be confirmed by counsel before publish]

Subprocessor processing

As listed in Annex 3, with the same nature, purpose and duration as the processing above.

Competent supervisory authority

For Restricted Transfers under the EU SCCs, the supervisory authority determined under Clause 13 of the EU SCCs; for the UK GDPR, the Information Commission (ICO); for the PDPA, the Personal Data Protection Commission. [Competent supervisory authority for each Customer to be confirmed by counsel before publish]

Annex 2: Technical and organisational measures

Marathon applies the following measures to Customer Personal Data. They are implemented controls and management commitments, not certified or independently assured controls, and they complete Annex II of the EU SCCs where they apply.

Identity and access checks

Requests carry a person or service identity, organisation, environment and connection. Current membership and authority are checked again before execution. Inactive memberships, unreviewed tools and unauthorised resources are denied. Internal service calls use scoped capabilities bound to an organisation, environment, operation and expiry.

Policy and approval controls

Reviewed requests are allowed by default. Customer administrators can choose default deny, deny writes in an environment, or require independent approval for writes. An approval is bound to the requester, connection, exact arguments, resource, and tool and policy versions; it expires, can be used once, and cannot be granted by the requester.

Authentication and sessions

Authentication uses WorkOS. Browser sessions use secure, HttpOnly cookies and can be revoked, and browser mutations require same-origin checks. Customer can connect its identity provider for single sign-on and directory sync where its plan includes them. Enforcement of multi-factor authentication depends on Customer’s identity provider and account settings.

Encryption

The durin website, application and gateway endpoints are served over HTTPS. Selected connection and export-destination credentials are encrypted at the application layer with AES-256-GCM and authenticated context, with key-ring support for rotation.

Data minimisation

Conversation capture defaults to metadata only and discards submitted message content before persistence. An administrator can enable redacted capture for 7, 90, or 180 days, or 360 days on Enterprise; expired captures become unreadable and scheduled cleanup removes them. Redaction is pattern-based and is not complete data loss prevention. Error diagnostics filter request fields, headers and user information.

Logging and audit

Required audit intent is recorded before a governed request executes. Policy decisions, approvals and execution outcomes are recorded separately, including outcomes that remain uncertain. Exports recheck the requester’s access and include per-part SHA-256 checksums; checksums do not make records tamper-proof.

Separation

Customer data is logically separated by organisation and environment, and each governed request is authorised against the requesting organisation, environment and current membership. Tenant isolation is included with Enterprise agreements.

Secure development

Changes are tracked in version control and checked by automated formatting, lint, type, contract and test suites. Continuous integration defines dependency auditing, secret scanning, license review and software bill of materials generation.

Personnel

Access to production systems and Customer Personal Data is limited to Marathon personnel who need it to operate, support or secure durin, under the confidentiality obligations in clause 5.

Incident response

Marathon maintains documented procedures for compromised identities, upstream consent revocation, key rotation and reconciling uncertain writes, and handles Security Incidents under clause 9.

Availability and recovery

Uptime, support and recovery commitments apply only where the Agreement includes them. [Backup, restore testing and recovery objectives to be confirmed by counsel before publish]

Assurance

No SOC 2 attestation, ISO certification or independent penetration-test result is claimed. Marathon is committed to meeting applicable PDPA and GDPR obligations and to aligning its security programme with ISO/IEC 27001 principles; these are management commitments, not certification.

Annex 3: Subprocessors

Customer authorises the Subprocessors below under clause 7. Changes are notified under clause 7.2, and the current schedule is published at https://getdurin.com/subprocessors.

Signatures

Each party signs below to agree to this DPA, including its Annexes. It takes effect when both parties have signed.